Convolutional neural networks have been significantly improving the results in many computer vision and image analysis tasks, especially in the field of image classification [1]}, [2]}. Yet, the predictions of neural networks can easily be manipulated, as shown in [3]}. An image changed by only a small amount, imperceptible for a human observer, is then misclassified by the neural model. Those perturbed images, called adversarial examples, have drawn a lot of attention recently. One reason is the possible lack of security they might cause. As shown in [4]}, an autonomous car could be fooled to mistake a stop sign for a 45mph speed limit, simply by adding small tapes at the right location. Although various counter-measures have already been suggested in the literature, new defense mechanisms have often been broken quickly again [5]}.
